tpm2_setco...uditstatus(1)

📦

version 5.8 · 10 versions

💅 tpm2_setcommandauditstatus(1) — General Commands Manual 🎀

okay bestie, pull up a chair, because this is the page for tpm2_setcommandauditstatus(1) and it's genuinely iconic. no cap.

✨ NAME ✨

tpm2_setcommandauditstatus(1) — add or remove TPM2 commands from the audited commands list. that's it, that's the whole vibe. 💖

✨ SYNOPSIS ✨

tpm2_setcommandauditstatus [OPTIONS] [ARGUMENT]

✨ DESCRIPTION ✨

so, tpm2_setcommandauditstatus(1) does exactly what it says on the tin (iconic behaviour, honestly): it adds TPM2 commands to the audited commands list, or takes them off. 👑

as an argument it takes the command as an integer or as a friendly string value. the friendly-string-to-COMMAND-CODE mapping lives down in the COMMAND CODE MAPPINGS section, so scroll when you need it, iykyk. 🦋

✨ OPTIONS ✨

-C, --hierarchy=OBJECT — specify either the owner or platform hierarchy. defaults to TPM_RH_OWNER when no value has been specified. the supported options are:
- o for TPM_RH_OWNER
- p for TPM_RH_PLATFORM
-P, --hierarchy-auth=AUTH — specifies the authorization value for the hierarchy. these authorization values should follow the "authorization formatting standards", see the section "Authorization Formatting". 🫶
-c, --clear-list — says that the TPM command you specified has to be taken off the audit list. when it's not specified, the default behaviour is to add the TPM command to the audit list. literally that simple. ✨
-g, --hash-algorithm=ALGORITHM — sets up the hashing algorithm for the audit digest. when it's not specified, the default audit digest algorithm is set to SHA256. periodt. 💅
ARGUMENT — the command line argument that specifies the TPM2 command code. fr, that's what it's for. 🎀

References

(this one's just a heading in the original, so hey, here it is — hi bestie 👋)

✨ COMMON OPTIONS ✨

this little collection of options is common to many programs and provides information that many users may expect. consider it the shared wardrobe everyone borrows from. 🧚

-h, --help=[man|no-man] — display the tool's manpage. by default it tries to invoke the manpager for the tool, but on failure it will output a short tool summary. this is the same behavior if the "man" option argument is specified — however, if explicit "man" is requested, the tool will provide errors from man on stderr. if the "no-man" option is specified (or the manpager just fails), the short options will be output to stdout. to successfully use the manpages feature you need the manpages installed or on MANPATH — see man(1) for more details. 📖
-v, --version — display version information for this tool plus the supported tctis, then exit. short and sweet. 💫
-V, --verbose — increase the information the tool prints to the console during its execution. when you use this option, the file and line number are printed. very "tell me everything" of it. 🔍
-Q, --quiet — silence normal tool output to stdout. shhh. 🤫
-Z, --enable-errata — enable the application of errata fixups. useful if an errata fixup needs to be applied to commands sent to the TPM. defining the environment variable TPM2TOOLS_ENABLE_ERRATA is equivalent. 🛠️
-z, --pwd-session — use a password session instead of a HMAC session for authentication. a clear text password is passed to the TPM to authorize the action. this option can be used to avoid problems when unsalted sessions are used in OpenSSL FIPS mode. if auth values are used, a salted session should be used for authentication. 🔐
-R, --autoflush — enable autoflush for transient objects created by the command. if a parent object is loaded from a context file, also the transient parent object will be flushed. autoflush can also be activated if the environment variable TPM2TOOLS_AUTOFLUSH is is set to yes or true. information many users may expect. 🚽✨

TCTI Configuration

the TCTI, or "Transmission Interface", is the communication mechanism with the TPM. TCTIs can be changed for communication with TPMs across different mediums. it's giving "universal adapter." 🔌

to control the TCTI, the tools respect:

the command line option -T or --tcti
the environment variable: TPM2TOOLS_TCTI.

Note: the command line option always overrides the environment variable. always. no debate. 💅

the current known TCTIs are:

tabrmd — the resource manager, called tabrmd. note that tabrmd and abrmd as a tcti name are synonymous. 👯
mssim — typically used for communicating to the TPM software simulator. 🖥️
device — used when talking directly to a TPM device file. 📟
none — do not initalize a connection with the TPM. some tools allow for off-tpm options and thus support not using a TCTI. tools that do not support it will error when attempted to be used without a TCTI connection. does not support ANY options and MUST BE presented as the exact text of "none". 🚫

the arguments to either the command line option or the environment variable are in the form:

<tcti-name>:<tcti-option-config>

specifying an empty string for either the <tcti-name> or the <tcti-option-config> results in the default being used for that portion respectively. 🎀

TCTI Defaults

when a TCTI is not specified, the default TCTI is searched for using dlopen(3) semantics. the tools will search for tabrmd, device and mssim TCTIs IN THAT ORDER and USE THE FIRST ONE FOUND. you can query what TCTI will be chosen as the default by using the -v option to print the version information. the "default-tcti" key-value pair will indicate which of the aforementioned TCTIs is the default. 🔎

Custom TCTIs

any TCTI that implements the dynamic TCTI interface can be loaded. the tools internally use dlopen(3), and the raw tcti-name value is used for the lookup. thus, this could be a path to the shared library, or a library name as understood by dlopen(3) semantics. bring your own, bestie. 🧚‍♀️

✨ TCTI OPTIONS ✨

this collection of options is used to configure the various known TCTI modules available:

device — for the device TCTI, the TPM character device file for use by the device TCTI can be specified. the default is /dev/tpm0.

Example: -T device:/dev/tpm0 or export TPM2TOOLS_TCTI="device:/dev/tpm0"

mssim — for the mssim TCTI, the domain name or IP address and port number used by the simulator can be specified. the defaults are 127.0.0.1 and 2321.

Example: -T mssim:host=localhost,port=2321 or export TPM2TOOLS_TCTI="mssim:host=localhost,port=2321"

abrmd — for the abrmd TCTI, the configuration string format is a series of simple key value pairs separated by a , character. each key and value string are separated by a = character.

the TCTI abrmd supports two keys:

bus_name : the name of the tabrmd service on the bus (a string).
bus_type : the type of the dbus instance (a string) limited to session and system.

specify the tabrmd tcti name and a config string of bus_name=com.example.FooBar:

      \--tcti=tabrmd:bus_name=com.example.FooBar

specify the default (abrmd) tcti and a config string of bus_type=session:

      \--tcti:bus_type=session

NOTE: abrmd and tabrmd are synonymous. the various known TCTI modules. 🫶

hash algorithm options — collection of options to specify hash algorithm. 🧮

✨ COMMAND CODE MAPPINGS ✨

the friendly strings below can be used en lieu of the raw integer values. literally type the vibe, not the number. 💫

-TPM2_CC_AC_GetCapability: 0x194
-TPM2_CC_AC_Send: 0x195
-TPM2_CC_ActivateCredential: 0x147
-TPM2_CC_Certify: 0x148
-TPM2_CC_CertifyCreation: 0x14a
-TPM2_CC_ChangeEPS: 0x124
-TPM2_CC_ChangePPS: 0x125
-TPM2_CC_Clear: 0x126
-TPM2_CC_ClearControl: 0x127
-TPM2_CC_ClockRateAdjust: 0x130
-TPM2_CC_ClockSet: 0x128
-TPM2_CC_Commit: 0x18b
-TPM2_CC_ContextLoad: 0x161
-TPM2_CC_ContextSave: 0x162
-TPM2_CC_Create: 0x153
-TPM2_CC_CreateLoaded: 0x191
-TPM2_CC_CreatePrimary: 0x131
-TPM2_CC_DictionaryAttackLockReset: 0x139
-TPM2_CC_DictionaryAttackParameters: 0x13a
-TPM2_CC_Duplicate: 0x14b
-TPM2_CC_ECC_Parameters: 0x178
-TPM2_CC_ECDH_KeyGen: 0x163
-TPM2_CC_ECDH_ZGen: 0x154
-TPM2_CC_EC_Ephemeral: 0x18e
-TPM2_CC_EncryptDecrypt: 0x164
-TPM2_CC_EncryptDecrypt2: 0x193
-TPM2_CC_EventSequenceComplete: 0x185
-TPM2_CC_EvictControl: 0x120
-TPM2_CC_FieldUpgradeData: 0x141
-TPM2_CC_FieldUpgradeStart: 0x12f
-TPM2_CC_FirmwareRead: 0x179
-TPM2_CC_FlushContext: 0x165
-TPM2_CC_GetCapability: 0x17a
-TPM2_CC_GetCommandAuditDigest: 0x133
-TPM2_CC_GetRandom: 0x17b
-TPM2_CC_GetSessionAuditDigest: 0x14d
-TPM2_CC_GetTestResult: 0x17c
-TPM2_CC_GetTime: 0x14c
-TPM2_CC_Hash: 0x17d
-TPM2_CC_HashSequenceStart: 0x186
-TPM2_CC_HierarchyChangeAuth: 0x129
-TPM2_CC_HierarchyControl: 0x121
-TPM2_CC_HMAC: 0x155
-TPM2_CC_HMAC_Start: 0x15b
-TPM2_CC_Import: 0x156
-TPM2_CC_IncrementalSelfTest: 0x142
-TPM2_CC_Load: 0x157
-TPM2_CC_LoadExternal: 0x167
-TPM2_CC_MakeCredential: 0x168
-TPM2_CC_NV_Certify: 0x184
-TPM2_CC_NV_ChangeAuth: 0x13b
-TPM2_CC_NV_DefineSpace: 0x12a
-TPM2_CC_NV_Extend: 0x136
-TPM2_CC_NV_GlobalWriteLock: 0x132
-TPM2_CC_NV_Increment: 0x134
-TPM2_CC_NV_Read: 0x14e
-TPM2_CC_NV_ReadLock: 0x14f
-TPM2_CC_NV_ReadPublic: 0x169
-TPM2_CC_NV_SetBits: 0x135
-TPM2_CC_NV_UndefineSpace: 0x122
-TPM2_CC_NV_UndefineSpaceSpecial: 0x11f
-TPM2_CC_NV_Write: 0x137
-TPM2_CC_NV_WriteLock: 0x138
-TPM2_CC_ObjectChangeAuth: 0x150
-TPM2_CC_PCR_Allocate: 0x12b
-TPM2_CC_PCR_Event: 0x13c
-TPM2_CC_PCR_Extend: 0x182
-TPM2_CC_PCR_Read: 0x17e
-TPM2_CC_PCR_Reset: 0x13d
-TPM2_CC_PCR_SetAuthPolicy: 0x12c
-TPM2_CC_PCR_SetAuthValue: 0x183
-TPM2_CC_Policy_AC_SendSelect: 0x196
-TPM2_CC_PolicyAuthorize: 0x16a
-TPM2_CC_PolicyAuthorizeNV: 0x192
-TPM2_CC_PolicyAuthValue: 0x16b
-TPM2_CC_PolicyCommandCode: 0x16c
-TPM2_CC_PolicyCounterTimer: 0x16d
-TPM2_CC_PolicyCpHash: 0x16e
-TPM2_CC_PolicyDuplicationSelect: 0x188
-TPM2_CC_PolicyGetDigest: 0x189
-TPM2_CC_PolicyLocality: 0x16f
-TPM2_CC_PolicyNameHash: 0x170
-TPM2_CC_PolicyNV: 0x149
-TPM2_CC_PolicyNvWritten: 0x18f
-TPM2_CC_PolicyOR: 0x171
-TPM2_CC_PolicyPassword: 0x18c
-TPM2_CC_PolicyPCR: 0x17f
-TPM2_CC_PolicyPhysicalPresence: 0x187
-TPM2_CC_PolicyRestart: 0x180
-TPM2_CC_PolicySecret: 0x151
-TPM2_CC_PolicySigned: 0x160
-TPM2_CC_PolicyTemplate: 0x190
-TPM2_CC_PolicyTicket: 0x172
-TPM2_CC_PP_Commands: 0x12d
-TPM2_CC_Quote: 0x158
-TPM2_CC_ReadClock: 0x181
-TPM2_CC_ReadPublic: 0x173
-TPM2_CC_Rewrap: 0x152
-TPM2_CC_RSA_Decrypt: 0x159
-TPM2_CC_RSA_Encrypt: 0x174
-TPM2_CC_SelfTest: 0x143
-TPM2_CC_SequenceComplete: 0x13e
-TPM2_CC_SequenceUpdate: 0x15c
-TPM2_CC_SetAlgorithmSet: 0x13f
-TPM2_CC_SetCommandCodeAuditStatus: 0x140
-TPM2_CC_SetPrimaryPolicy: 0x12e
-TPM2_CC_Shutdown: 0x145
-TPM2_CC_Sign: 0x15d
-TPM2_CC_StartAuthSession: 0x176
-TPM2_CC_Startup: 0x144
-TPM2_CC_StirRandom: 0x146
-TPM2_CC_TestParms: 0x18a
-TPM2_CC_Unseal: 0x15e
-TPM2_CC_Vendor_TCG_Test: 0x20000000
-TPM2_CC_VerifySignature: 0x177
-TPM2_CC_ZGen_2Phase: 0x18d

✨ EXAMPLES ✨

add TPM2_CC_Unseal to the list of audited commands. look at her go 🫶

tpm2_setcommandauditstatus TPM2_CC_Unseal

✨ Returns ✨

tools can return any of the following codes:

0 — success. 🎉
1 — general non-specific error. 😭
2 — options handling error. 🙈
3 — authentication error. 🔐
4 — TCTI related error. 🔌
5 — non supported scheme. applicable to tpm2_testparams. 💀

(part 1 done, but we're not done-done — more coming, bestie 💖)

💅 LIMITATIONS 💅

Okay bestie, listen up because this one's important — no cap.

This tool expects a session to be already established via tpm2_startauthsession(1), and it needs one of the following to actually work:

direct device access 🔌
extended session support with tpm2-abrmd

Without it, most resource managers will not save session state between command invocations. Like, the vibe check fails and your session just… vanishes into the void 😭. Fr fr, set up the session first or you're gonna have a bad time.

💀 BUGS 💀

Spotted a bug? Don't suffer in silence, bestie — slide into the Github Issues. That's literally where the bug reports live. Go be the main character who files a clean repro. 🫶

🎀 HELP 🎀

Need a human? See the Mailing List. The community is there, they're iconic, they will help you out. ✨

👑 LICENSE 👑

This work is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0). Slay, legally speaking. 💅

And that's a wrap on the whole page, bestie! 🌈 This gem comes to you from tpm2-tools — that's the source for the page you just read — with the date chilling down in the footer where manpage footers always live. Go forth, audit those creation statuses, and remember: session first, questions later. 💖🦋⭐

📦 where this page comes from

arch rolling: tpm2-tools 5.8-1 · BSD-3-Clause
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-06: a language model's rewrite of the original, under its terms